Project metadata: direct PyPI URL is not considered verified

[woodruffw]

This is a tiny thing I noticed while testing out @facutuesca's changes: if a project lists its own PyPI URL via project.urls, we don't currently consider it verified.

For example, abi3info: https://pypi.org/project/abi3info/2024.8.13/

In this case the Homepage is marked as unverified, despite being https://pypi.org/project/abi3info/.

Here's the metadata itself, as it appears in abi3info's pyproject.toml:

[project.urls]
Homepage = "https://pypi.org/project/abi3info/"
Issues = "https://github.com/woodruffw/abi3info/issues"
Source = "https://github.com/woodruffw/abi3info"
Documentation = "https://woodruffw.github.io/abi3info/"

Expected behavior

I think we should consider these "trivially" verified, i.e. if project $foo has a URL that equals exactly https://pypi.org/project/$foo/ (or https://pypi.org/p/$foo/), then we should consider that URL verified.

(There might be a minor hiccup around normalizing $foo for comparison, since I believe the /p/ and /project/ routes are tolerant of non-normalized project names).

CC @facutuesca @di for thoughts 🙂

xref #16205

[di]

Makes sense to me! This should probably support a couple different equivalent URLs:

• https://pypi.org/project/abi3info/
• https://pypi.org/p/abi3info/
• https://pypi.python.org/project/abi3info/
• https://pypi.python.org/p/abi3info/
• https://python.org/pypi/abi3info/

Including with/without trailing slashes too.

(It should also be trivial to verify the github.io URL as well I think!)

[facutuesca]

Also makes sense to me, looking into the implementation now

[facutuesca]

#16485 implements the verification for links to PyPI's project page. I'll do the github.io URL in a separate PR